The Federal Trade Commission said on Wednesday that it has adopted final amendments to the Children’s Online Privacy Protection Rule (COPPA) that address the need for stricter rules regarding children under 13 and their use of websites, social networks and mobile apps.
The update is the result of a review initiated back in 2010 to ensure that the COPPA Rule keeps up with evolving technology, including the way children now utilize and navigate the Internet through the increased use of mobile devices and social networking. The Commission said the amendments reflect public feedback and careful consideration of the entire record of the rulemaking.
"The Commission takes seriously its mandate to protect children’s online privacy in this ever-changing technological landscape," said FTC Chairman Jon Leibowitz. "I am confident that the amendments to the COPPA Rule strike the right balance between protecting innovation that will provide rich and engaging content for children, and ensuring that parents are informed and involved in their children’s online activities."
One change to the COPPA Rule is the definition of an "operator". It now includes a child-directed site or service that integrates outside services (plugins, ad networks, etc.) that collect personal information from its visitors. Excluded from this definition are platforms such as Google Play and Apple's App Store.
Also changed is the definition of a "website or online service directed to children". It now includes plug-ins or ad networks that have actual knowledge that they are collecting personal information through a child-directed website or online service. Sites and services that target children only as a secondary audience must get parental consent if the children identify themselves as younger than 13.
"The definition of 'collection' of personal information has been changed so that operators may allow children to participate in interactive communities without parental consent, so long as the operators take reasonable measures to delete all or virtually all children’s personal information before it is made public," the FTC said.
"Personal Information" has been updated to include geolocation information, and media that contains a child's image or voice like pictures, videos and audio files. It also now includes "personal identifiers" that can be used to recognize users over time and across different websites or online services. For the latter, parental notice and consent isn't required "when an operator collects a persistent identifier for the sole purpose of supporting the website or online service’s internal operations, such as contextual advertising, frequency capping, legal compliance, site analysis, and network communications."
"The amended Final Rule revises the parental notice provisions to help ensure that operators’ privacy policies, and the direct notices they must give parents before collecting children’s personal information, are concise and timely," the FTC said.
The COPPA Rule was mandated when Congress passed the Children’s Online Privacy Protection Act of 1998. It forces websites and services to give notice and acquire parental consent when collecting, using, or disclosing personal information of children under 13. They must also keep that information secure, and are prohibited from luring kids into coughing up more info than what is deemed reasonably necessary.
To read the full list of changes, read the FTC's announcement here.